CIPT Privacy Program Implementation and Operations 2

Question 1

Under the US HIPAA Breach Notification Rule, how quickly must covered entities notify affected individuals of an unsecured PHI breach?

Accepted Answer

Without unreasonable delay and no later than 60 days after discovery

Answer

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and within 60 days of discovering a breach of unsecured PHI.

Question 2

Which US state law, effective January 2020, grants California consumers the right to know what personal information is collected about them and to request its deletion?

Accepted Answer

California Consumer Privacy Act (CCPA)

Answer

The CCPA, effective January 1, 2020, established rights for California consumers including access, deletion, and opt-out of sale of personal information.

Question 3

What does a 'privacy program gap analysis' involve?

Accepted Answer

Comparing the current state of privacy practices against a target framework to identify deficiencies

Answer

A gap analysis maps existing privacy controls against a regulatory framework or best-practice standard to identify where the program falls short and prioritize remediation.

Question 4

Which operational practice ensures that privacy controls remain effective as systems, regulations, and threats evolve over time?

Accepted Answer

Continuous monitoring and periodic privacy program reviews

Answer

Continuous monitoring detects control failures and changing risk conditions, while periodic reviews reassess whether the program still meets current regulatory and business requirements.

Question 5

A privacy team implements a process to handle user requests to access, correct, or delete their personal data. What is this process called?

Accepted Answer

Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process

Answer

A DSAR fulfillment process includes identity verification, data location, compilation, review, and timely response to requests from data subjects exercising their legal rights.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Privacy Program Implementation and Operations 2